POLICY
ICT third-party risk under DORA, EBA outsourcing guidelines, and the supervisory expectation around critical-vendor concentration.
POLICY & RESILIENCE
Supervisors have spent two years reading exit plans that assume an exit nobody has priced, budgeted or rehearsed. In January the most durable excuse for that stops being available.
APPLIED AI
Fifteen years of model risk doctrine was rewritten in April, and the one paragraph that will matter most to a 2026 risk committee is the one that says which models the guidance does not cover.
INFRASTRUCTURE & CRYPTOGRAPHY
Most banks have costed the test. Fewer have costed the supply chain it now depends on: an accredited tester market on a synchronised three-year clock, and threat intelligence that must come from outside every single time.
PAYMENTS & MONEY
Corporate and investment banks now treat cyber recovery, ISO 20022 fallback rails across RTGS, instant and tokenised networks, and quantum-safe treasury controls as one always-on operating model — the board-grade response to DORA Articles 5 and 6, FHE, QKD and PQC primitives, and ICT third-party concentration risk.
APPLIED AI
Cloud native banking in 2026 is no longer a debate about whether banks can use cloud. It is a regulated platform-engineering discipline: how to run critical services across containers, virtual…
